Resolving failed or hanging mount points in a clustered storage solution for containers

ABSTRACT

A clustered storage system may include potentially many different nodes, each including a storage driver and a kernel module. A node may mount a virtual storage volume for the use of a container application at the node. The storage driver and kernel module may receive a request from a storage driver at a different node and respond by indicating whether the virtual storage volume is in active use. In this way, the clustered storage system may safely but forcibly unmount a virtual storage volume having a failed or hanging mount point so that the volume may be mounted on a different node.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of, and claims priority to,U.S. patent application Ser. No. 15/824,259 (PRTWP010) now U.S. Pat. No.10,503,441, by Goutham Rao and Vinod Jayaraman, filed Nov. 28, 2017,titled “RESOLVING FAILED OR HANGING MOUNT POINTS IN A CLUSTERED STORAGESOLUTION FOR CONTAINERS”, which is incorporated herein by reference inits entirety and for all purposes.

TECHNICAL FIELD

The present disclosure relates generally to containerized applicationsand more specifically to containerized scalable storage applications.

DESCRIPTION OF RELATED ART

One of the most difficult challenges facing software developers isinteroperability of software between different computing environments.Software written to run in one operating system typically will not runwithout modification in a different operating system. Even within thesame operating system, a program may rely on other programs in order tofunction. Each of these dependencies may or may not be available on anygiven system, or may be available but in a version different from theversion originally relied upon. Thus, dependency relationships furthercomplicate efforts to create software capable of running in differentenvironments.

In recent years, the introduction of operating-system-levelvirtualization has facilitated the development of containerized softwareapplications. A system configured with operating-system-levelvirtualization includes a container engine that operates on top of theoperating system. Importantly, the container engine is configured tooperate interchangeably in different environments (e.g., with differentoperating systems). At the same time, the container engine is configuredto present a standardized interface to one or more software containers.

Each software container may include computer programming code forperforming one or more tasks. Examples of software containers includeweb servers, email servers, web applications, and other such programs.Each software container may include some or all of the softwareresources that the software in the container needs in order to function.For example, if a software container includes a web application writtenin the Python programming language, the software container may alsoinclude the Python programming language modules that the web applicationrelies upon. In this way, the software container may be installed andmay execute successfully in different computing environments as long asthe environment includes a container engine.

SUMMARY

The following presents a simplified summary of the disclosure in orderto provide a basic understanding of certain embodiments of theinvention. This summary is not an extensive overview of the disclosureand it does not identify key/critical elements of the invention ordelineate the scope of the invention. Its sole purpose is to presentsome concepts disclosed herein in a simplified form as a prelude to themore detailed description that is presented later.

Various embodiments of the present invention relate generally todevices, systems, and methods for facilitating the correction of failedor hanging mount points in a containerized storage system. According tovarious embodiments, a computing device may include a communicationsinterface, a processor, and memory.

According to various embodiments, the communications interface may beoperable to receive from a remote computing node a virtual storagevolume activity request message addressed to a storage driverimplemented at the computing device. The virtual storage volume activityrequest message may identify a virtual storage volume mounted at thecomputing device and configured to access data stored on one or morestorage devices accessible via a network.

According to various embodiments, a processor operable to determinewhether the virtual storage volume is associated with one or more blockdevice references in an operating system running at the computingdevice, wherein the determination is made based on communicationsbetween the storage driver and a kernel module associated with theoperating system.

According to various embodiments, the memory may be operable to storeone or more block device references. The processor may also be operableto instruct the communications interface to transmit a virtual storagevolume activity response message from the storage driver to the remotecomputing node. The message may indicate whether the virtual storagevolume is associated with one or more block device references in theoperating system.

In particular embodiments, the virtual storage volume may be configuredas a data storage service within a containerized application systemconfigured to run a plurality of distributed application instanceswithin the operating system, where each application instance correspondswith a designated application. The plurality of distributed applicationsmay include the storage driver. In some configurations, the one or morestorage devices may include at least two storage devices.

In particular embodiments, the request message may be sent in responseto a mount request to mount the virtual storage volume at the remotecomputing device. The virtual storage volume may be in a non-responsivestate in which the virtual storage volume is not responding to storagerequests. In addition, in some configurations the virtual storage volumeis not associated with one or more block device references. In suchconfigurations, the virtual storage volume activity response message mayindicate that the virtual storage volume may be safely mounted at theremote computing device. A selected one of the one or more block devicereferences may include a respective identifier associated with arespective open file accessible via the virtual storage volume.

These and other embodiments are described further below with referenceto the figures.

BRIEF DESCRIPTION OF THE DRAWINGS

The disclosure may best be understood by reference to the followingdescription taken in conjunction with the accompanying drawings, whichillustrate particular embodiments.

FIG. 1 illustrates an example of an arrangement of components in acontainerized storage system, configured in accordance with one or moreembodiments.

FIG. 2 illustrates an example of a storage container node, configured inaccordance with one or more embodiments.

FIG. 3 illustrates an example of a method for controlling the mounting astorage volume, performed in accordance with one or more embodiments.

FIG. 4 illustrates an example of a method for determining storage volumeactivity, performed in accordance with one or more embodiments.

FIG. 5 illustrates an example of a server, configured in accordance withone or more embodiments.

FIG. 6 illustrates a method 600 of mounting a volume in a container,performed in accordance with one or more embodiments.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Reference will now be made in detail to some specific examples of theinvention including the best modes contemplated by the inventors forcarrying out the invention. Examples of these specific embodiments areillustrated in the accompanying drawings. While the invention isdescribed in conjunction with these specific embodiments, it will beunderstood that it is not intended to limit the invention to thedescribed embodiments. On the contrary, it is intended to coveralternatives, modifications, and equivalents as may be included withinthe spirit and scope of the invention as defined by the appended claims.

For example, the techniques of the present invention will be describedin the context of particular containerized storage environments.However, it should be noted that the techniques of the present inventionapply to a wide variety of different containerized storage environments.In the following description, numerous specific details are set forth inorder to provide a thorough understanding of the present invention.Particular example embodiments of the present invention may beimplemented without some or all of these specific details. In otherinstances, well known process operations have not been described indetail in order not to unnecessarily obscure the present invention.

Various techniques and mechanisms of the present invention willsometimes be described in singular form for clarity. However, it shouldbe noted that some embodiments include multiple iterations of atechnique or multiple instantiations of a mechanism unless notedotherwise. For example, a system uses a processor in a variety ofcontexts. However, it will be appreciated that a system can use multipleprocessors while remaining within the scope of the present inventionunless otherwise noted. Furthermore, the techniques and mechanisms ofthe present invention will sometimes describe a connection between twoentities. It should be noted that a connection between two entities doesnot necessarily mean a direct, unimpeded connection, as a variety ofother entities may reside between the two entities. For example, aprocessor may be connected to memory, but it will be appreciated that avariety of bridges and controllers may reside between the processor andmemory. Consequently, a connection does not necessarily mean a direct,unimpeded connection unless otherwise noted.

Overview

Techniques and mechanisms described herein provide for resolving failedor hanging mount points in a clustered storage solution for containers.A containerized application system is one in which an applicationinstance may be created as a container at a computing node based on anapplication image. In many configurations, a virtual storage volume maybe mounted on a disk connected with an application instance on such anode. Importantly, the system must ensure that the virtual storagevolume is not simultaneously mounted on two different nodes sincewriting data to the same virtual storage volume from more than onesource tends to quickly corrupt the virtual storage volume. According totechniques and mechanisms described herein, containerized storagevolumes implemented at each node may communicate with each other andwith kernel plugins implemented at each node to determine whether avirtual storage volume is being actively used, even if the virtualstorage volume is mounted but in a failed or hanging state.

Example Embodiments

In a containerized application system such as Docker, each compute nodeimplements a container layer that runs in an operating system. Thecontainer layer acts as an intermediate layer to facilitate theexecution of one or more container applications. The container system isstandardized so that a container application may be instantiated on anyof various operating systems and on any of various types of hardware.

In many configurations, potentially many instances of a containerapplication are created on potentially many different nodes. A clusteredstorage solution can be employed to provide access to data. In aclustered storage solution, a virtual storage volume can be created.Such a virtual storage volume can span potentially many differentphysical disks and can be made accessible to any of the nodes.

The process of making a virtual storage volume available for writing ona disk attached to a particular storage node is referred to as“mounting”. Importantly, the clustered storage solution must ensure thata virtual storage volume is mounted for writing by no more than a singlenode since simultaneous writes by different nodes tends to quicklycorrupt a storage volume.

In a clustered storage solution for containers, schedulers are in chargeof moving around volume mount points across a cluster so that containersalways have access to their persistent data. Examples of schedulers mayinclude, but are not limited to: Kubernetes, Mesos, and Swarm.

One challenge faced by schedulers is addressing failed or hanging mountpoints. For example, a component may request to mount a virtual storagevolume on a first node, but the scheduler may determine that the virtualstorage volume is still mounted on a second node. If the second node isactively using the virtual storage volume, then the mount request by thefirst node should fail. However, in some instances, an error conditionsuch as a software bug, network failure, systems crash, or other problemmay have occurred on the second node that has caused the virtual storagevolume to be placed in a state of failure such as having a hanging mountpoint. For example, the storage container driver at the second node maycrash. As another example, the second node may be unreachable to thescheduler due to a network failure. As yet another example, the storagedriver may either not have received an unmount call or an unmount callwas never sent by the user of a storage volume. When in a failure state,the virtual storage volume may appear to the scheduler be mounted on thesecond node but may not actually be in use by the second node. However,the failed volume may not be usable by another node in a conventionalsystem even though no application is using the volume.

In conventional systems, the second node is unable to recover from thefailure condition, and the virtual storage volume is likely to persistin the failure state. Further, the schedule in conventional systems hasno way to remedy the failure or even determine that the virtual storagevolume is not in active use at the second node. Accordingly, in aconventional system the virtual storage volume would typically remain ina state of failure until a human manually intervened by correcting theerror condition. While the virtual storage volume remained in the stateof failure, it would be inaccessible by any node in the clusteredstorage solution.

In a conventional storage solution, the storage is provided through anetwork protocol such as iSCSI. When the scheduler requests that a hungvolumes be mounted on another node, the conventional storage driver thatimplements the network protocol does not have a method to detect whetherthe volume is still being used or not. They would only know that thevolume is currently mounted on another node and therefore not usable onany other node.

Also, in a conventional storage solution, volumes are used from within acontainer application associated with one entity, while the clusteredstorage solution is provided by a different entity. In this case, it istypically impossible in a conventional storage system for the storageprovider to query the namespace of the container to figure out whetherthe volume is being used or not.

In a conventional storage solution, the problem is compounded by themany different types of container technologies being deployed. Forexample, the REX-Ray container storage driver can be used with backingstorages like Amazon EBS to provide volumes to containers. However, whenEBS volumes are attached to an EC2 instance, they cannot be attached toanother EC2 instance. Thus, if a scheduler or orchestrator does notrequest REX-Ray to detach the EBS volume from the node where it is nolonger being used, REX-Ray will not be able to use the same EBS volumeon another node. REX-Ray also does not have a way to determine whetherthe EBS volume is being used on the node where it is mounted. Thus, inthis case REX-Ray cannot unmount it to be used by another node.

In many conventional storage systems, such as those in which a protocolsuch as iSCSI is employed, the storage provider has a minimal presenceon the nodes where the volume is being used and cannot gatherinformation about the usage of the volume on the node. Suchconfigurations do not allow seamless correction of hanging mount pointsor other error conditions. In these cases, manual intervention would berequired to forcefully unmount these volumes before they can be used inthe cluster again. This hampers automation and high availability ofservices.

According to various embodiments, techniques and mechanisms describedherein allow a clustered storage solution to determine whether a volumeis actually being used by a container or client on a node on which thevolume is mounted. The system allows a volume to be mounted on adifferent storage node only if it is no longer in active use by theprevious storage node, which eliminates data corruption and servicedowntime that may result from the volume being simultaneously accessedby different nodes.

According to various embodiments, each compute node may include astorage driver and an operating system kernel module. The kernel modulemay be used to expose virtual block devices and to keep a track of thenumber of open handles on the block device. Using this information, thestorage driver can check whether the block device is actually being usedon that node or if it is safe to remove the block device.

According to various embodiments, a “best effort” approach may beemployed to try to unmount a volume if it is already mounted on anothernode or if the node on which the volume was previously mounted isunreachable (e.g., marked as offline in a storage cluster). For example,the system may first attempt to unmount a volume from the node where itis mounted. If at that time the kernel module indicates that the volumeis in active use on the node, then the unmount from the remote nodewould fail and the mount operation on the new node would fail as well.If instead no open file hands exist, then no client is using the volumeand the system is free to unmount the volume on the old node andre-mount it on the new node so that the container can continue itsexecution.

According to various embodiments, techniques and mechanisms describedherein may be used to guarantees that a container will always haveaccess to its data across a cluster from any node when using a clusteredstorage solution even when components like container schedulers andorchestrators have errors in which they do not behave according to theircontract for volume state lifecycles. Further, techniques and mechanismsdescribed herein may eliminate the need for manual intervention in theevent of failures or errors introduced into volume management bycontainer schedulers or orchestrators.

According to various embodiments, techniques and mechanisms describedherein provide for seamless fail overs of containers without affectingthe consistency of the data on the volumes even in cases whereconventional approaches would have required manual intervention.Accordingly, techniques and mechanisms described herein can result inlower downtime for services and fewer things for users to automate andworry about. Thus, techniques and mechanisms described herein providefor the more efficient usage of storage resources on storage nodes andthe improved functioning of distributed storage systems.

Techniques and mechanisms described herein may facilitate the operationof a scalable storage container node system. In some embodiments, ascalable storage container node system may allow application containersin a virtualized application system to quickly and directly provisionand scale storage. Further, the system may be configured to provide oneor more user experience guarantees across classes of applications.According to various embodiments, the system may pool the capacity ofdifferent services into virtual storage volumes and auto-allocatestorage as application storage traffic scales or bursts. For instance, asingle virtual storage volume may include hundreds or thousands ofterabytes of storage space aggregated across many different storagedevices located on many different physical machines.

In some embodiments, storage containers may communicate directly withserver resources such as hardware storage devices, thus reducing oreliminating unnecessary virtualization overhead. Storage containers maybe configured for implementation in a variety of environments, includingboth local computing environments and cloud computing environments. Insome implementations, storage volumes created according to thetechniques and mechanisms described herein may be highlyfailure-tolerant. For example, a virtual storage volume may include datastored on potentially many different storage nodes. A storage node mayfail for any of various reasons, such as hardware failure, networkfailure, software failure, or server maintenance. Data integrity may bemaintained even if one or more nodes that make up a storage volume failduring data storage operations.

According to various embodiments, a storage system that allows access bydifferent computing devices is referred to herein as a “distributedstorage system.” Alternately, or additionally, such a storage system maybe referred to herein as a “clustered storage system.”

FIG. 1 illustrates an example of an arrangement of components in acontainerized storage system 100, configured in accordance with one ormore embodiments. The storage system 100 includes a master node 102 incommunication with a plurality of application nodes 104, 106, and 108.Each node has implemented thereon a storage driver 124, a kernel module128, and a scheduler agent 132. In addition, the master node includes ascheduler 126. Each node can mount one or more of a plurality of virtualvolumes 118, 120, and 122. Each virtual volume can include storage spaceon one or more of a plurality of storage disks 110, 112, 114, and 116 ina storage pool 130.

According to various embodiments, the clustered storage system 100 shownin FIG. 1 may be implemented in any of various physical computingcontexts. For example, some or all of the components shown in FIG. 1 maybe implemented in a cloud computing environment such as Amazon WebServices (AWS), Microsoft Azure, or Google Cloud. As another example,some or all of the components shown in FIG. 1 may be implemented in alocal computing environment such as on nodes in communication via alocal area network (LAN) or other privately managed network.

In some implementations, a node is an instance of a container systemimplemented on a computing device such as the computing device shown inFIG. 5. In some configurations, multiple nodes may be implemented on thesame physical computing device. Alternately, a computing device maycontain a single node. An example configuration of a container node isdiscussed in further detail with respect to FIG. 2.

According to various embodiments, each node may be configured toinstantiate and execute one or more containerized application instance.Each node may include many components not shown in FIG. 1. Thesecomponents may include hardware components, such as those discussed withrespect to FIG. 5, and/or software components, such as those discussedwith respect to FIG. 2.

According to various embodiments, each node may include a storage driver124. The storage driver 124 may perform any of various types ofstorage-related operations for the node. For example, the storage driver124 may facilitate the mounting or unmounting of virtual storagevolumes. As another example, the storage driver 124 may facilitate datastorage or retrieval requests associated with a mounted virtual storagevolume. The storage driver 124 may be substantially similar or identicalto the privileged storage container 216 shown in FIG. 2.

In some embodiments, each node may include a kernel module 128. Thekernel module may receive from the storage driver a request to unmount avirtual volume. The kernel module may then identify a number ofreferences to the virtual volume. Such a reference may be referred toherein as a block device reference. Each reference may reflect an openfile handle or other such interaction between the file system and thevirtual volume. If the reference count is zero, then the kernel modulemay unmount the virtual volume and return a message indicating success.If instead the reference count is positive, then the kernel module mayreturn a message indicating failure.

According to various embodiments, each node may include a scheduleragent 132. The scheduler agent 132 may facilitate communications betweennodes. For example, the scheduler 126 in the master node may communicatewith the scheduler agent 132. The scheduler agent 132 may thencommunicate with the storage driver 124 to perform an operation such asunmounting a virtual volume.

In some implementations, the disks 110, 112, 114, and 116 may beaccessible to the container nodes via a network. For example, the disksmay be located in storage arrays containing potentially many differentdisks. In such a configuration, which is common in cloud storageenvironments, each disk may be accessible for potentially many nodes toaccess. A storage pool such as the pool 130 may include potentially manydifferent disks.

According to various embodiments, the virtual storage volumes 118, 120,and 122 are logical storage units created by the distributed storagesystem, of which the kernel modules and storage drivers are a part. Eachvirtual storage volume may be implemented on a single disk or may spanpotentially many different physical disks. At the same time, data frompotentially many different virtual volumes may be stored on a singledisk. In this way, a virtual storage volume may be created that ispotentially much larger than any available physical disk. At the sametime, a virtual storage volume may be created in such a way as to berobust to the failure of any individual physical disk. Further, thevirtual storage volume may be created in such a way as to allow rapidand simultaneous read access by different nodes. Thus, a single virtualstorage volume may support the operation of containerized applicationsimplemented in a distributed fashion across potentially many differentnodes.

In some embodiments, the master node 102 is configured to manage theoperations of the clustered storage system. For example, the scheduler126 at the master node 102 may be configured to receive a request tomount a virtual volume for use at a particular node. The scheduler 126may then communicate with that node to provide instructions to mount thevirtual volume.

FIG. 2 illustrates an example of a storage container node 202. Accordingto various embodiments, a storage container node may be a serverconfigured to include a container engine and a privileged storagecontainer. The storage container node 202 shown in FIG. 2 includes aserver layer 204, an operating system layer 206, a container engine 208,a web server container 210, an email server container 212, a webapplication container 214, and a privileged storage container 216.

In some embodiments, the storage container node 202 may serve as aninterface between storage resources available at a server instance andone or more virtual storage volumes that span more than one physicaland/or virtual server. For example, the storage container node 202 maybe implemented on a server that has access to a storage device. At thesame time, a different storage container node may be implemented on adifferent server that has access to a different storage device. The twostorage nodes may communicate to aggregate the physical capacity of thedifferent storage devices into a single virtual storage volume. Thesingle virtual storage volume may then be accessed and addressed as aunit by applications running on the two storage nodes or at on anothersystem.

At 204, the server layer is shown. According to various embodiments, theserver layer may function as an interface by which the operating system206 interacts with the server on which the storage container node 202 isimplemented. A storage container node may be implemented on a virtual orphysical server. For example, the storage container node 202 may beimplemented at least in part on the server shown in FIG. 5. The servermay include hardware such as networking components, memory, physicalstorage devices, and other such infrastructure. The operating systemlayer 206 may communicate with these devices through a standardizedinterface provided by the server layer 204.

At 206, the operating system layer is shown. According to variousembodiments, different computing environments may employ differentoperating system layers. For instance, a physical or virtual serverenvironment may include an operating system based on Microsoft Windows,Linux, or Apple's OS X. The operating system layer 206 may provide,among other functionality, a standardized interface for communicatingwith the server layer 204.

At 208, a container engine layer is shown. According to variousembodiments, the container layer may provide a common set of interfacesfor implementing container applications. For example, the containerlayer may provide application programming interfaces (APIs) for tasksrelated to storage, networking, resource management, or other suchcomputing tasks. The container layer may abstract these computing tasksfrom the operating system. A container engine may also be referred to asa hypervisor, a virtualization layer, or anoperating-system-virtualization layer.

In some implementations, the separation of the computing environmentinto a server layer 204, an operating system layer 206, and a containerengine layer 208 may facilitate greater interoperability betweensoftware applications and greater flexibility in configuring computingenvironments. For example, the same software container may be used indifferent computing environments, such as computing environmentsconfigured with different operating systems on different physical orvirtual servers.

At storage container node may include one or more software containers.For example, the storage container node 202 includes the web servercontainer 220, the email server container 212, and the web applicationcontainer 214. A software container may include customized computer codeconfigured to perform any of various tasks. For instance, the web servercontainer 220 may provide files such as webpages to client machines uponrequest. The email server 212 may handle the receipt and transmission ofemails as well as requests by client devices to access those emails. Theweb application container 214 may be configured to execute any type ofweb application, such as an instant messaging service, an onlineauction, a wiki, or a webmail service. Although that storage containernode 202 shown in FIG. 2 includes three software containers, otherstorage container nodes may include various numbers and types ofsoftware containers.

At 216, a privileged storage container is shown. According to variousembodiments, the privileged storage container may be configured tofacilitate communications with other storage container nodes to provideone or more virtual storage volumes. A virtual storage volume may serveas a resource for storing or retrieving data. The virtual storage volumemay be accessed by any of the software containers 220, 212, and 214 orother software containers located in different computing environments.For example, a software container may transmit a storage request to thecontainer engine 208 via a standardized interface. The container engine208 may transmit the storage request to the privileged storage container216. The privileged storage container 216 may then communicate withprivileged storage containers located on other storage container nodesand/or may communicate with hardware resources located at the storagecontainer node 202 to execute the request.

In some implementations, one or more software containers may be affordedlimited permissions in the computing environment in which they arelocated. For example, in order to facilitate a containerized softwareenvironment, the software containers 210, 212, and 214 may be restrictedto communicating directly only with the container engine 208 via astandardized interface. The container engine 208 may then be responsiblefor relaying communications as necessary to other software containersand/or the operating system layer 206.

In some implementations, the privileged storage container 216 may beafforded additional privileges beyond those afforded to ordinarysoftware containers. For example, the privileged storage container 216may be allowed to communicate directly with the operating system layer206, the server layer 204, and/or one or more physical hardwarecomponents such as physical storage devices. Providing the storagecontainer 216 with expanded privileges may facilitate efficient storageoperations such as storing, retrieving, and indexing data.

FIG. 3 illustrates an example of a method 300 for controlling themounting of a storage volume, performed in accordance with one or moreembodiments. The method 300 may be performed at a storage node, suchthose shown in FIG. 1. The method 300 may be employed to mount a virtualstorage volume that is potentially already mounted at a different node.For example, the method 300 may be employed to switch a virtual storagevolume from one node to another, even if the virtual storage volume is“hung” or in a nonresponse state in which the virtual storage volume isnot responding to storage requests.

In one example, the method 300 may be implemented at the node B 106shown in FIG. 1. For instance, the Node B 106 may receive a request tomount the Virtual Volume A 118, which in FIG. 1 is currently mounted onNode A 104. The Virtual Volume A 118 may be in any of various states.For example, the Virtual Volume A 118 may be in active use by Node A104, in which case forcibly unmounting the Virtual Volume A 118 fromNode A 104 and re-mounting it on Node B 106 may result in datacorruption on the Virtual Volume A 118. As another example, the VirtualVolume A 118 may not be in active use by Node A 104, in which case theVirtual Volume A 118 may be safely unmounted from Node A 104 andremounted on Node B 106. As yet another example, the Virtual Volume A118 may be in a “hung” or non-responsive state in which it is notresponding to storage requests.

At 302, a request is received at a scheduler on a master node to mount avolume on a first node. According to various embodiments, the requestmay be generated by an application such as a containerized applicationinstance or a storage driver implemented at the first node. Forinstance, the request may be received at the schedule 126 shown in FIG.1 and may include a request to mount the Virtual Volume A 118 on Node B106.

At 304, a volume mount instruction is transmitted to a containerizedstorage driver at the first node. For example, the volume mountinstruction may be transmitted from the scheduler 126 to the storagedriver 124 at the Node B 106. According to various embodiments, thevolume mount instruction may include information indicating to thestorage driver that the storage driver should attempt to mount thevirtual volume. For example, the volume mount instruction may includeinformation such as an identifier associated with the virtual volume,one or more disks on which data associated with the virtual volume isstored, and/or a node at which the virtual volume is currently mounted.

At 306, a determination is made as to whether the volume is identifiedas currently mounted on a second node. According to various embodiments,the determination may be made based on information received along withthe volume mount instruction. For instance, the scheduler may trackwhich virtual volumes are mounted on which nodes and transmit thisinformation to the first node.

In particular embodiments, the determination may be made based oninformation maintained at the first node. For example, the StorageDriver 124 at the Node B 106 may communicate with storage drivers atother nodes to track which virtual volumes are mounted on which nodes.

At 308, if the volume is identified as mounted on the second node, thencommunications between the second node and the first node are initiatedto determine if the volume is active on the second node. For example,the Node B 106 may communicate directly with the Storage Driver 124 atthe Node A 104 via a network. Alternately, or additionally, thescheduler 126 may communicate with the Storage Driver 124 at the Node A104. According to various embodiments, the communications between thesecond node and the first node may include information such as anidentifier associated with the virtual volume, an identifier associatedwith the first node, and any other relevant information employed by thesecond node to provide a response to the request.

At 310, a determination is made as to whether the volume is active onthe second node. In some embodiments, the determination may be madebased on a communication with the storage driver at the second node. Forexample, the kernel module may keep track of reference counts that mayindicate connections such as open file handles associated with variousstorage volumes. The storage driver 124 may then send a message to thekernel module that identifies the virtual volume. The kernel module mayuse an identifier included in the message to determine whether theidentified virtual storage volume is associated with any references suchas open file handles. Each open file handle may be associated with afile that is opened for reading or writing on a particular storagevolume. Thus, the presence of a reference to the virtual volume mayindicate the presence of an open file handle or other such connection,which may indicate that the virtual storage volume is in active use bythe second node.

A situation in which a storage volume is ostensibly mounted but is notresponding to requests is referred to herein as a “hanging mount point”or a “hung” storage volume. In particular embodiments, the determinationmade at operation 310 can be made successfully identify whether thevirtual storage volume is in active use even if the storage volume is ina “hung” or unresponsive state in which it is not responding to storagerequests. A storage volume may enter such a state for any of variousreasons. For example, an error conduction may result from networkfailure in communications between the node and a disk on which dataassociated with the storage volume is located. As another example, anerror conduction may result from a software bug in the storage driver,the operating system, an application communicating with the storagevolume, or another application. Nevertheless, identifying referencecounts is a basic feature of an operating system, so the kernel modulecan identify whether a virtual volume is associated with referencecounts even if the virtual storage volume is not responding to messages.

According to various embodiments, the determination made at 310 mayinvolve a response message transmitted from the second node as towhether the identified storage volume is associated with any open filedhandles. If the identified storage volume is associated with one or morereferences, then the determination may be made that the volume isactive. If instead the identified storage volume is not associated withone or more references, then the determination may be made that thevolume is not active.

At 316, if the volume is active on the second node, then a mount failuremessage is transmitted. According to various embodiments, the mountfailure message may include information such as an identifier associatedwith the virtual storage volume and/or the node at which the virtualstorage volume is currently mounted. The mount failure message may betransmitted to any of various recipients, which may include, but are notlimited to: the scheduler at the master node, the storage driver atother storage nodes, and one or more reporting modules configured foractivity tracking.

At 312, if the volume is not active on the second node, then the storagevolume is mounted on the first node. According to various embodiments,mounting is a process which operating system makes files and directorieson a storage volume available for users and applications to access viathe computer's file system. In general, the process of mounting includesthe operating system acquiring access to the storage volume and thenrecognizing, reading, and processing file system structure and metadataon it. After that, the file system on the virtual storage volume isregistered to the virtual file system component in the operating system.The location in the VFS associated with the newly-mounted virtualstorage system is referred to as a mount point. An opposite process ofmounting is called unmounting, in which the operating system cuts offall user access to files and directories on the mount point, writes theremaining queue of user data to the storage device, refreshes filesystem metadata, and then relinquishes access to the virtual storagevolume. After unmounting, the virtual storage volume is safe to mount onother nodes.

At 314, a mount success message is transmitted when the virtual volumeis successfully mounted. According to various embodiments, the mountsuccess message may include information such as an identifier associatedwith the virtual storage volume and/or the node at which the virtualstorage volume is currently mounted. The mount success message may betransmitted to any of various recipients, which may include, but are notlimited to: the scheduler at the master node, the storage driver atother storage nodes, and one or more reporting modules configured foractivity tracking.

In particular embodiments, the method 300 may be employed to controloperations other than mounting, such as attachment. For example, whenthe storage driver receives a request to attach a disk to the node, thedriver may first check whether the disk is attached on any other node.If it is attached on a second node, then a request may be send from thefirst node to the second to unmount the disk on that second node. If thedetach is successful, then the device may be attached locally. Thus,although the method 300 refers to “mounting” as the operation beingcontrolled, the method 300 is not limited to the control of mountingoperations.

FIG. 4 illustrates an example of a method 400 for determining storagevolume activity, performed in accordance with one or more embodiments.According to various embodiments, the method 400 may be performed at anode in a distributed storage system, such as the node A 104 shown inFIG. 1. For example, the method 400 may be performed at a storage driverin communication with a kernel module at the node.

At 402, a request to determine if a volume is in use at a containerizedstorage driver on a node is received. According to various embodiments,the request may be received from a storage driver implemented at adifferent storage node than the one at which the method 400 isperformed. For example, the request may be received from a storagedriver implemented at a storage node at which a request has beenreceived to mount a virtual storage volume that is indicated ascurrently being mounted on the node at which the method 400 is beingperformed. In this case, the request may be received in association withthe communications initiated at operation 308 shown in FIG. 3.

At 404, an active volume query message is transmitted to the kernelmodule at the node. According to various embodiments, the active volumequery message may include information identifying the virtual storagevolume. The active volume query message may also include otherinformation, such as information characterizing the request orauthentication information authorizing the request.

At 406, an attempt is made to unmount the volume from the file system.The node may attempt to unmount the volume at least in part because themount itself may be associated with an open handle for the volume.Further, if the path has been bind mounted inside the container, then itmay also have an open handle for the volume, which would prevent thesystem from detaching the volume because it would appear to be in use bya container.

At 408, a determination is made as to whether one or more openreferences exist for the volume, which is also referred to herein as ablock device. For example, a reference may refer to a file handle is anumber that the operating system assigns temporarily to a file when itis opened. Each file handle may include information such as a uniqueidentifier, the identity of the volume on which the file resides, andthe identity and/or location on disk of the file. The operating systemuses the file handle internally when accessing the file, and theoperating system removes the file handle when the file is closed. Thus,a single virtual storage volume may be associated with potentially manydifferent file handles if many different files stored on the virtualstorage volume have been opened for access.

According to various embodiments, the presence of a reference to thevirtual storage volume may indicate that the virtual storage volume isin an unstable state in which the operating system may be in the processof writing data to the virtual storage volume. For example, unmountingthe file system while a file handle is open is likely to lead to datacorruption since the writing process may be interrupted.

In some embodiments, the determination as to whether references existfor the block device may be made by the kernel module. For example, thekernel module may use the identifying information included in therequest to query a special area of memory that is reserved for trackingreferences.

At 410, if the kernel module determines that no references exist for theblock device, then an active volume response message is received fromthe kernel module indicating that the volume is not in use. If insteadthe kernel module determines that one or more references exist for theblock device, then at 410 an active volume response message is receivedfrom the kernel module indicating that the volume is in use.

According to various embodiments, the active volume response message maybe transmitted from the kernel module within a node to the storagedriver implemented at the same node. For example, the active volumeresponse message may be transmitted from the kernel module 128 to thestorage driver 124 shown in FIG. 1.

At 414, a response to the request is transmitted. In some embodiments,the response may be transmitted to the entity that transmitted therequest. For example, the response may be transmitted via a network to adifferent node. As another example, the response may be transmitted to aprocess implemented on the node itself.

FIG. 5 illustrates one example of a server. According to particularembodiments, a system 500 suitable for implementing particularembodiments of the present invention includes a processor 501, a memory503, an interface 511, and a bus 515 (e.g., a PCI bus or otherinterconnection fabric) and operates as a container node. When actingunder the control of appropriate software or firmware, the processor 501is responsible for implementing applications such as an operating systemkernel, a containerized storage driver, and one or more applications.Various specially configured devices can also be used in place of aprocessor 501 or in addition to processor 501. The interface 511 istypically configured to send and receive data packets or data segmentsover a network.

Particular examples of interfaces supported include Ethernet interfaces,frame relay interfaces, cable interfaces, DSL interfaces, token ringinterfaces, and the like. In addition, various very high-speedinterfaces may be provided such as fast Ethernet interfaces, GigabitEthernet interfaces, ATM interfaces, HSSI interfaces, POS interfaces,FDDI interfaces and the like. Generally, these interfaces may includeports appropriate for communication with the appropriate media. In somecases, they may also include an independent processor and, in someinstances, volatile RAM. The independent processors may controlcommunications-intensive tasks such as packet switching, media controland management.

According to various embodiments, the system 500 is a server configuredto run a container engine. For example, the system 500 may be configuredas a storage container node as shown in FIG. 1. The server may includeone or more hardware elements as shown in FIG. 5. In someimplementations, one or more of the server components may bevirtualized. For example, a physical server may be configured in alocalized or cloud environment. The physical server may implement one ormore virtual server environments in which the container engine isexecuted. Although a particular server is described, it should berecognized that a variety of alternative configurations are possible.For example, the modules may be implemented on another device connectedto the server.

FIG. 6 illustrates a method 600 of mounting a volume in a container.According to various embodiments, the method 600 may be employed tomount a volume, for instance as discussed in operation 312 shown in FIG.3. The method 600 may be implemented at a computing node, such as theNode A 104 shown in FIG. 1.

At 602, a request is received from the container system (e.g., Docker)to mount a volume for a container. In some embodiments, the volume maybe mounted in a particular application container instance executed in acontainerized software system. For example, a volume may be mounted forthe specific use of a MySQL instance or other application instance.

At 604, attach instructions are issued for the volume. According tovarious embodiments, the attach instructions may be used to attach adisk to the node. For example, the attach instructions may involvecommunication with one or more remote services to establishcommunications between the disk and the node over a network.

At 606, if it is determined that the attach instructions failed, then anerror is returned at operation 618. According to various embodiments,the attach instructions may fail for any of various reasons such asnetwork failure or a permissions error.

At 608, a mount instruction is issued for the volume. According tovarious embodiments, one or more standard operating system functions maybe employed to mount the volume for use in the file system. At 610, ifit is determined that the mount instruction failed, then an error isreturned at operation 618. The mount may fail for any of variousreasons, which may include, but are not limited to: file system errors,permission issues, or corrupted data.

Under a naíve configuration, a race condition may develop. For example,it is possible that before the container engine issues an rbind on anode (N1) for the mount path returned by the storage driver, anothernode (N2) could request the device be unmounted and detached. This ispossible if multiple pods on different nodes (N1 and N2) are trying touse the same the storage driver volume. Since no process is using theblock device yet, the detach would succeed on node N1. This would causethe container engine to rbind an empty local directory into thecontainer on node N1 and cause writes to be made to a location otherthan the storage volume, which is not what the application would expect.The storage volume would be attached on to node N2.

According to various embodiments, to prevent this from happening, thesystem may ensure that an unmounted path which is rbinded by thecontainer engine is not writeable. This can be achieved by performingthe following steps during Mount( ) First, the mountpath is created.Second, a command such as “chattr+i” is used to mark the path asread-only. Third, the virtual storage volume is mounted into the mountpath. The “chattr +i” command is a filesystem command which marks afilesystem path as read-only. However, this attribute is overwritten ifanother device is mounted on the same path, since the mount point thenrepresents another filesystem. This ensures that if the virtual volumeis not mounted in the path, then nothing will be able to perform writesin the directory, which prevents writes from erroneously going to alocal path instead of the virtual storage volume as would be expected bythe application.

In particular embodiments, a similar process is performed in reverseduring unmounting. First, the storage driver is unmounted. Second, the“chattr” command is used to mark the path as writeable. Third, themountpath is deleted. By performing the above steps, the system canguarantee that any attempts by the container engine to rbind themountpath inside a container will result in the application receiving aread-only path, thereby avoiding any writes to an incorrect location.

At 612, the container system performs an rbind of the path where thevolume is mounted to a path inside the container. According to variousembodiments, the rbind may effectively replace the path where the volumeis mounted within the operating system filesystem with a path specificto the container so that other containers or applications cannot readfrom or write to the volume.

At 614, a determination is made as to whether the rbind was successful.If so, a success message is returned at operation 616. If not, an errormessage is returned at operation 618. The rbind may fail for any ofvarious reasons, which may include, but are not limited to: a missingsource directory, file system errors, permission errors, or corrupteddata.

In the foregoing specification, the invention has been described withreference to specific embodiments. However, one of ordinary skill in theart appreciates that various modifications and changes can be madewithout departing from the scope of the invention as set forth in theclaims below. Accordingly, the specification and figures are to beregarded in an illustrative rather than a restrictive sense, and allsuch modifications are intended to be included within the scope ofinvention.

1. A computing device comprising: a communications interface operable toreceive from a remote computing node a virtual storage volume activityrequest message addressed to a storage driver implemented at thecomputing device, the virtual storage volume activity request messageidentifying a virtual storage volume mounted at the computing device; aprocessor operable to determine whether the virtual storage volume isassociated with one or more block device references in an operatingsystem running at the computing device; and memory operable to store oneor more block device references, wherein the processor is furtheroperable to instruct the communications interface to transmit a virtualstorage volume activity response message from the storage driver to theremote computing node, the virtual storage volume activity responsemessage indicating whether the virtual storage volume is associated withone or more block device references in the operating system, wherein thevirtual storage volume is configured as a data storage service within acontainerized application system.
 2. The computing device recited inclaim 1, wherein the containerized application system configured to runa plurality of distributed application instances within the operatingsystem, each application instance corresponding with a designatedapplication.
 3. The computing device recited in claim 2, wherein theplurality of distributed applications includes the storage driver. 4.The computing device recited in claim 1, wherein the determination ismade based on communications between the storage driver and a kernelmodule associated with the operating system.
 5. The computing devicerecited in claim 1, wherein the request message is sent in response to amount request to mount the virtual storage volume at the remotecomputing device.
 6. The computing device recited in claim 5, whereinthe virtual storage volume is in a non-responsive state in which thevirtual storage volume is not responding to storage requests.
 7. Thecomputing device recited in claim 6, wherein the virtual storage volumeis not associated with one or more block device references.
 8. Thecomputing device recited in claim 7, wherein the virtual storage volumeactivity response message indicates that the virtual storage volume maybe safely mounted at the remote computing device.
 9. The computingdevice recited in claim 1, wherein a selected one of the one or moreblock device references comprises a respective identifier associatedwith a respective open file accessible via the virtual storage volume.10. A method to be performed by one or more processors, the methodcomprising: receiving a virtual storage volume activity request messageat a storage driver on a first compute node from a second compute nodevia a communications interface, the virtual storage volume activityrequest message identifying a virtual storage volume mounted at thefirst compute node; determining, at a processor on the first computenode, whether the virtual storage volume is associated with one or moreblock device references in an operating system running at the firstcompute node; and transmitting a virtual storage volume activityresponse message from the storage driver to the second compute node viathe communications interface, the virtual storage volume activityresponse message indicating whether the virtual storage volume isassociated with one or more block device references in the operatingsystem, wherein the virtual storage volume is configured as a datastorage service within a containerized application system.
 11. Themethod recited in claim 10, wherein the containerized application systemconfigured to run a plurality of distributed application instanceswithin the operating system, each application instance correspondingwith a designated application.
 12. The method recited in claim 11,wherein the plurality of distributed applications includes the storagedriver.
 13. The method recited in claim 10, wherein the determination ismade based on communications between the storage driver and a kernelmodule associated with the operating system.
 14. The method recited inclaim 10, wherein the request message is sent in response to a mountrequest to mount the virtual storage volume at the remote computingdevice, and wherein the virtual storage volume is in a non-responsivestate in which the virtual storage volume is not responding to storagerequests.
 15. The method recited in claim 14, wherein the virtualstorage volume is not associated with one or more block devicereferences, and wherein a selected one of the one or more block devicereferences comprises a respective identifier associated with arespective open file accessible via the virtual storage volume.
 16. Themethod recited in claim 15, wherein the virtual storage volume activityresponse message indicates that the virtual storage volume may be safelymounted at the remote computing device.
 17. One or more machine readablemedia having instructions stored thereon for performing a method, themethod comprising: receiving a virtual storage volume activity requestmessage at a storage driver on a first compute node from a secondcompute node via a communications interface, the virtual storage volumeactivity request message identifying a virtual storage volume mounted atthe first compute node; determining, at a processor on the first computenode, whether the virtual storage volume is associated with one or moreblock device references in an operating system running at the firstcompute node; and transmitting a virtual storage volume activityresponse message from the storage driver to the second compute node viathe communications interface, the virtual storage volume activityresponse message indicating whether the virtual storage volume isassociated with one or more block device references in the operatingsystem, wherein the virtual storage volume is configured as a datastorage service within a containerized application system.
 18. The oneor more machine readable media recited in claim 17, wherein thecontainerized application system configured to run a plurality ofdistributed application instances within the operating system, eachapplication instance corresponding with a designated application. 19.The one or more machine readable media recited in claim 17, wherein thedetermination is made based on communications between the storage driverand a kernel module associated with the operating system
 20. The one ormore machine readable media recited in claim 17, wherein the virtualstorage volume is in a non-responsive state in which the virtual storagevolume is not responding to storage requests.